ASN.1.

ASN.1 (Abstract Syntax Notation One) is a formal notation, defined in ITU-T X.680–X.681, for describing structured data — integers, sequences, sets, choices, and tagged types — independently of any programming language or CPU. Companion standard X.690 defines the wire encodings: BER (basic), CER, DER (distinguished), while X.691 defines PER (packed). Every element is a tag-length-value (TLV) triple, which is why an X.509 certificate is literally a SEQUENCE of TBSCertificate, signatureAlgorithm, and signatureValue.

ASN.1 underpins X.509/PKI, CMS/PKCS#7, PKCS#12, LDAP, Kerberos, SNMP, and telecom signalling (3GPP S1AP/NGAP, GSM MAP). DER matters for security: it mandates a single canonical encoding (definite length, minimal integers, sorted SET OF), so a signature or hash over an ASN.1 structure is reproducible and cannot be silently re-encoded. BER's permissiveness — indefinite lengths, redundant tags — is a classic source of parser differentials and signature-bypass tricks.

Because certificate parsing happens before authentication, ASN.1 decoders are a high-value attack surface. Real flaws include CVE-2016-2108 (OpenSSL "negative zero" ANY-field memory corruption), CVE-2021-3712 (read buffer overrun on non-NUL-terminated ASN1_STRINGs, leaking key memory), and CVE-2022-0778 (an infinite loop reachable by parsing a crafted certificate). Defences: use memory-safe or fuzz-hardened decoders, enforce strict DER, and cap nesting depth and length.

flowchart LR
  S[ASN.1 schema in X.680] --> M[In-memory structure]
  M --> ENC{Encoding rules}
  ENC -->|DER canonical| D[Bytes for signing / PKI]
  ENC -->|BER permissive| B[Bytes - interop only]
  ENC -->|PER compact| P[Bytes for telecom links]
  D --> W[Wire / stored certificate]
  B --> W
  P --> W
  W --> DEC[TLV decoder]
  DEC --> V{Strict DER & bounds checks?}
  V -->|Yes| OK[Validated object]
  V -->|No| VULN[Parser differential / overflow / DoS]